mass.report
Scan Intelligence Report0/100
critical Risk
qrivnote.com
https://qrivnote.com/
IP
104.21.82.17 · Cloudflare, Inc.
Location
Toronto, Canada
Domain Age
13 days
HTTP
200 · 10.8s
SSL
Valid· WE1, Google Trust Services, US
Status
COMPLETED
Domain Intelligence: qrivnote.com
Scanned 2 times since Feb 17, 2026, 02:59 AM UTC
✗ Critical (100)
Linked Phishing Report
This scan is attached to a vendor submission report
Brand
Privnote
Vendors
25/25
Status
completed
✓ sophos✓ apple✓ emsisoft✓ spamhaus✓ openphish✓ cisa✓ apwg✓ netcraft✓ phishreport✓ urlquery✓ phishtank✓ microsoft✓ yandex✓ avg✓ virustotal✓ eset✓ mcafee✓ urlscan✓ google✓ fortiguard✓ urlabuse✓ brightcloud✓ norton✓ avast✓ bitdefender
KB/IOK Matches (0)—
No KB/IOK detections were recorded for this scan.
Privnote
Credential PhishingTechnology · 4/5/2026
Summary
The site at qrivnote.com is a typosquat clone of the legitimate Privnote service (privnote.com). It mimics the functionality of sending self-destructing notes and includes a login form to capture user credentials. The domain is only one character different from the real domain, indicating a clear intent to deceive users.
Attack Techniques (4)
Typosquat domain (qrivnote.com → privnote.com)Cloned UI with identical functionality for sending self-destructing notesLogin form present for credential harvestingHidden form inputs detected for potential data exfiltration
Indicators of Compromise (4)
▸Domain: qrivnote.com
▸Page title: 'qrivnote - Send notes that self-destruct after being read.'
▸POST request to / with hidden inputs
▸External script loading from the same domain mimicking legitimate services
Risk AssessmentUsed in abuse reports
The domain qrivnote.com is a newly registered typosquat of the legitimate Privnote service, differing by only one character. The site contains a login form designed to capture user credentials, and the presence of hidden inputs raises concerns about potential data exfiltration. The SSL certificate is newly issued, further indicating the site's malicious intent. Immediate action is required to mitigate the risk of user credential theft.
Recommended Action
Suspend Domain
Cross-Reference8
URL Intelligence
Domain Intelligence
IP Intelligence
Public threat feed available — JSON API